Targeted Social Engineering Campaign Against Rust Maintainers: Defending Crates.io and the Open Source Supply Chain

---
title: Browser or Meeting Application Spawning Shell or Script Interpreter
tid: 3f9c2a71-8b4d-4e6a-9c12-7d5e8f0a1b23
status: experimental
description: Detects web browsers or video conferencing applications spawning command shells or script interpreters, consistent with ClickFix-style clipboard attacks and fake codec installer execution observed in the campaign targeting Rust/crates.io maintainers.
references:
  - https://blog.rust-lang.org/2026/09/17/targeted-attacks/
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\zoom.exe'
      - '\teams.exe'
      - '\ms-teams.exe'
      - '\webex.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\msiexec.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate browser-launched installers; investigate command line content
level: high
---
title: Suspicious Codec or Meeting Plugin Installer Execution
tid: 8a1d4e62-5f7b-4c39-a2e8-6b0d9c1e3f45
status: experimental
description: Detects execution of installer binaries with filenames referencing audio codecs, drivers, or meeting plugins from user-writable download/temp locations, matching the fake audio codec lure reported against Rust maintainers.
references:
  - https://blog.rust-lang.org/2026/09/17/targeted-attacks/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Local\Microsoft\Windows\INetCache\'
  selection_name:
    Image|contains:
      - 'codec'
      - 'audio_driver'
      - 'audio-driver'
      - 'audiosetup'
      - 'audio_setup'
      - 'meeting_plugin'
      - 'meeting-plugin'
      - 'meetingplugin'
      - 'mic_fix'
      - 'microphone'
      - 'driver_update'
  condition: selection_path and selection_name
falsepositives:
  - Legitimate audio driver updates from OEM tools; verify publisher signature and download source
level: medium
---
title: Process Accessing Cargo or Git Credential Stores
tid: c4e7f1a9-2d8b-4a56-b3c1-9e0f5d2a7b68
status: experimental
description: Detects non-development processes reading credential files used for crates.io publishing and GitHub authentication, a key objective of infostealers deployed in maintainer-targeting campaigns.
references:
  - https://blog.rust-lang.org/2026/09/17/targeted-attacks/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/09/17
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\.cargo\credentials'
      - '\.ssh\id_'
      - '\.git-credentials'
  selection_exclude:
    Image|endswith:
      - '\cargo.exe'
      - '\rustc.exe'
      - '\git.exe'
      - '\ssh.exe'
      - '\code.exe'
      - '\devenv.exe'
  condition: selection_target and not selection_exclude
falsepositives:
  - Backup or sync software; endpoint backup agents should be allowlisted after verification
level: high

// Hunt: Browser/Meeting app spawning shell or script interpreter (ClickFix / fake codec TTP)
// Reference: https://blog.rust-lang.org/2026/09/17/targeted-attacks/
let BrowserOrMeeting = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","zoom.exe","teams.exe","ms-teams.exe","webex.exe","zoom.us","Google Chrome","firefox"]);
let Shells = dynamic(["powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","msiexec.exe","curl.exe","wget.exe","bash","sh","zsh"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (BrowserOrMeeting)
| where FileName in~ (Shells)
| project TimeGenerated, DeviceName, AccountName,
          ParentProcess = InitiatingProcessFileName,
          ChildProcess = FileName, ProcessCommandLine,
          SHA256, ReportId, DeviceId
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | project DeviceId, InitiatingProcessId = ProcessId, RemoteUrl, RemoteIP, RemotePort, NetTime = TimeGenerated
) on DeviceId
| where isnotempty(RemoteUrl) or isnotempty(RemoteIP)
| summarize Connections = make_set(strcat(RemoteUrl, " (", RemoteIP, ":", RemotePort, ")"), 10)
  by TimeGenerated, DeviceName, AccountName, ParentProcess, ChildProcess, ProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt: Download-cradle and encoded command execution on developer workstations
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("iex", "Invoke-Expression", "irm ", "Invoke-RestMethod",
                                    "FromBase64String", " -enc ", " -e ", "curl ", "wget ")
  and ProcessCommandLine has_any ("| sh", "| bash", "| iex", "| powershell")
| project TimeGenerated, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

-- Hunt: Developer-targeting social engineering execution artifacts
-- Reference: https://blog.rust-lang.org/2026/09/17/targeted-attacks/
LET browsers = ('chrome', 'msedge', 'firefox', 'brave', 'zoom', 'teams', 'webex')
LET shells = ('powershell', 'pwsh', 'cmd.exe', 'wscript', 'cscript', 'mshta', 'rundll32', 'msiexec', 'bash', '/bin/sh', 'zsh')

SELECT Pid,
       Ppid,
       Name AS ChildProcess,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE (
        -- Child of a browser or meeting app
        Ppid IN (
          SELECT Pid FROM pslist()
          WHERE Name =~ '(?i)chrome|msedge|firefox|brave|zoom|teams|webex'
        )
        AND Name =~ '(?i)powershell|pwsh|cmd\.exe|wscript|cscript|mshta|rundll32|msiexec|bash|^sh$|zsh'
      )
      OR CommandLine =~ '(?i)(iex|Invoke-Expression|FromBase64String|curl .+\| ?(ba)?sh|wget .+\| ?(ba)?sh)'

-- Hunt: Crates.io and SCM credential file exposure on developer endpoints
SELECT FullPath,
       Size,
       Mtime,
       Ctime
FROM glob(globs=[
  'C:/Users/*/.cargo/credentials*',
  'C:/Users/*/.git-credentials',
  'C:/Users/*/.ssh/id_*',
  '/home/*/.cargo/credentials*',
  '/home/*/.git-credentials',
  '/home/*/.ssh/id_*',
  '/Users/*/.cargo/credentials*',
  '/Users/*/.git-credentials'
])

# Maintainer workstation audit - fake codec / ClickFix campaign TTPs
# Run elevated. Read-only audit; outputs JSON for central collection.

$results = [ordered]@{ Hostname = $env:COMPUTERNAME; Timestamp = (Get-Date).ToString('o') }

# 1. Recently executed installer-like files from user-writable paths matching codec/meeting lures
$suspiciousNames = '*codec*','*audio*driver*','*audio*setup*','*meeting*plugin*','*mic*fix*','*driver*update*'
$paths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:LOCALAPPDATA\Temp")
$found = foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include $suspiciousNames -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            Select-Object FullName, LastWriteTime, Length
    }
}
$results.SuspiciousInstallers = @($found)

# 2. Check for alternate-data-stream / Zone.Identifier on downloaded files (mark-of-the-web review)
$results.MotWFiles = @(Get-ChildItem "$env:USERPROFILE\Downloads" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    ForEach-Object {
        $zone = Get-Content -Path $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue
        if ($zone) { [PSCustomObject]@{ File = $_.FullName; LastWrite = $_.LastWriteTime } }
    })

# 3. Crates.io credential exposure check
$cargoCred = "$env:USERPROFILE\.cargo\credentials.toml"
$results.CargoCredentialPresent = Test-Path $cargoCred
if ($results.CargoCredentialPresent) {
    $results.CargoCredentialLastModified = (Get-Item $cargoCred).LastWriteTime
    Write-Warning "crates.io token file present. If compromise is suspected, rotate immediately at https://crates.io/settings/tokens"
}

# 4. Recent PowerShell execution with download-cradle patterns (from process command line history via event log)
$cradleEvents = Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104 } -MaxEvents 2000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'iex|Invoke-Expression|FromBase64String|Invoke-RestMethod|DownloadString' } |
    Select-Object -First 20 TimeCreated, @{n='Snippet';e={ $_.Message.Substring(0, [Math]::Min(300, $_.Message.Length)) }}
$results.DownloadCradleScriptBlocks = @($cradleEvents)

$results | ConvertTo-Json -Depth 4

#!/usr/bin/env bash
# Linux/macOS maintainer workstation audit - social engineering campaign TTPs
# Read-only. Run as the developer user (or root for full visibility).

echo "=== Audit: $(hostname) @ $(date -u +%FT%TZ) ==="

echo "--- [1] Suspicious installer/script names in Downloads and /tmp (last 30 days) ---"
find ~/Downloads /tmp /var/tmp -maxdepth 3 -type f \( \
  -iname '*codec*' -o -iname '*audio*driver*' -o -iname '*audio*setup*' -o \
  -iname '*meeting*plugin*' -o -iname '*mic*fix*' -o -iname '*driver*update*' \) \
  -mtime -30 -exec ls -la {} \; 2>/dev/null

echo "--- [2] Recently modified shell history entries with download cradles ---"
for hfile in ~/.bash_history ~/.zsh_history; do
  [ -f "$hfile" ] && grep -nE 'curl .*(\||bash|sh)|wget .*(\||bash|sh)|base64 -d|eval' "$hfile" | tail -20
done

echo "--- [3] Publish credential file presence ---"
for cred in ~/.cargo/credentials.toml ~/.cargo/credentials ~/.git-credentials ~/.npmrc ~/.pypirc; do
  if [ -f "$cred" ]; then
    echo "PRESENT: $cred (perms: $(stat -c '%a' "$cred" 2>/dev/null || stat -f '%Lp' "$cred"), modified: $(stat -c '%y' "$cred" 2>/dev/null || stat -f '%Sm' "$cred"))"
  fi
done

echo "--- [4] SSH private keys world-readable check ---"
find ~/.ssh -maxdepth 1 -name 'id_*' ! -name '*.pub' -exec sh -c \
  'p=$(stat -c "%a" "$1" 2>/dev/null || stat -f "%Lp" "$1"); [ "$p" != "600" ] && echo "BAD PERMS ($p): $1"' _ {} \;

echo "--- [5] Unexpected persistence: cron and launch agents modified in last 14 days ---"
find /etc/cron* /var/spool/cron ~/Library/LaunchAgents ~/.config/autostart -mtime -14 -type f 2>/dev/null

echo "=== Audit complete ==="